fix(18): WR-02 derive seed flag from DB write, not a stale pre-flight SELECT

The seed handler computed seeded from a pre-flight SELECT then returned
seeded:!alreadySet. Under a genuine concurrent race both requests can
SELECT the empty table, both enter the insert branch, and both return
seeded:true though only one row was actually written. Replace the
SELECT + conditional onDuplicateKeyUpdate with a single INSERT IGNORE
and derive seeded from affectedRows (1 = inserted, 0 = ignored/existing
row preserved, D-03). On MariaDB onDuplicateKeyUpdate(value=value)
reports affectedRows 1 for both insert and no-op, so it cannot
distinguish them; INSERT IGNORE can. timezone is bound via a
parameterized sql template and is already IANA-validated by zod. Adds a
test asserting seeded:false for a directly-pre-inserted row.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

apps/api/tests/routes/admin.test.ts

@@ -813,4 +813,35 @@ describe('admin timezone config', () => {
       .limit(1);
     expect(row?.value).toBe('America/New_York');
   });
+
+  // -------------------------------------------------------------------------
+  // POST seed — `seeded` flag is derived from what the DB actually did (WR-02)
+  // -------------------------------------------------------------------------
+
+  it('POST seed reports seeded:false when a row was pre-inserted directly, not via the endpoint (WR-02 accurate flag)', async () => {
+    const adminId = await seedUser('tz-admin-seed-derived', true);
+    currentDevUserId = adminId;
+    const app = await getApp();
+
+    // Insert the row directly (bypassing the seed endpoint) so no request-scoped
+    // pre-flight SELECT could have observed "unset". A correct implementation must
+    // derive seeded from the INSERT result (affectedRows), so this returns false.
+    await db.insert(appConfig).values({ key: 'household_timezone', value: 'America/Denver' });
+
+    const res = await app.fetch(
+      jsonRequest('POST', '/api/admin/config/timezone/seed', { timezone: 'Asia/Tokyo' }),
+    );
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as { ok: boolean; seeded: boolean };
+    expect(body.ok).toBe(true);
+    expect(body.seeded).toBe(false);
+
+    // D-03 preserved: the directly-inserted value is untouched.
+    const [row] = await db
+      .select({ value: appConfig.value })
+      .from(appConfig)
+      .where(eq(appConfig.key, 'household_timezone'))
+      .limit(1);
+    expect(row?.value).toBe('America/Denver');
+  });
 });